metadata
license: mit
tags:
- security
- poc
- executorch
Harmless PoC: ExecuTorch get_constant_buffer_data offsets OOB
Program::get_constant_buffer_data indexes constant_segment.offsets[i] using a forged FlatBuffer vector length with no bound against the program buffer. Under default Program::Verification::Minimal, loading a malicious .pte and requesting a high buffer index triggers ASan heap-buffer-overflow READ at program.cpp:453.
Distinct from MethodMeta sizes OOB, WebGPUDelegateHeader, and PTE segment integer-overflow hardening (#18662/#19268).
Files
poc_constant_buffer_asan.cpp,asan.log(offsets-oob)NOTES.md
./poc_constant_buffer_asan offsets-oob